Countries › Mexico › Guide › 13. Regulation › Regulation in Mexico: merger control and antitrust, personal data, anti money laundering, anti corruption and environmental permits

Regulation in Mexico: merger control and antitrust, personal data, anti money laundering, anti corruption and environmental permits

Last verified: 2026-10-26 · Status: Changing

Five regimes shape day to day compliance for a foreign owned business in Mexico: merger control and antitrust under the Federal Economic Competition Law, now enforced by the new National Antimonopoly Commission (CNA), and personal data under a new 2025 law supervised by the Ministry of Anticorruption and Good Government. Anti money laundering duties fall on any business carrying out a listed vulnerable activity, such as real estate development, vehicle or jewelry sales and non bank lending, with client identification, monthly notices to the Ministry of Finance and outright bans on large cash payments. Companies are directly liable for bribery and other serious administrative offences, with an integrity policy as the main mitigating factor, and projects in listed industries need a federal environmental impact authorization before any work starts.

USD conversions use MXN 18.5026 per US dollar, the US Federal Reserve H.10 noon buying rate in New York for 16 October 2026 (FRED series DEXMXUS), the latest observation available when this page was verified. Peso amounts set in UMA use the 2026 daily UMA of MXN 117.31, in force since 1 February 2026 (INEGI publication in the DOF of 9 January 2026, as cited in the IMSS Technical Council agreement). Conversions are for orientation only.

Key facts

Merger filing threshold, deal value in Mexico (16 million UMA, 2026)	1876960000 MXNLFCE art. 86, section I, as of 2026-10-26 · in force
Merger filing threshold, deal value in Mexico	16000000 UMALFCE art. 86, section I, as of 2026-10-26 · in force
Merger filing threshold, Mexican sales or assets of two or more parties (40 million UMA, 2026)	4692400000 MXNLFCE art. 86, section III, as of 2026-10-26 · in force
Commission term to resolve a merger notice after a complete filing	30 daysLFCE art. 90, section V, as of 2026-10-26 · in force
Maximum fine for absolute monopolistic practices	15 % of incomeLFCE art. 127, section IV, as of 2026-10-26 · in force
Maximum fine for closing without merger clearance	8 % of incomeLFCE art. 127, section VIII, as of 2026-10-26 · in force
Maximum term to answer an ARCO request	20 daysLFPDPPP art. 31, as of 2026-10-26 · in force
Maximum data protection fine before doubling for sensitive data	320000 UMALFPDPPP art. 59, section III, as of 2026-10-26 · in force
AML notice due by this day of the following month	17 day of monthLFPIORPI art. 23, as of 2026-10-26 · in force
AML record retention	10 yearsLFPIORPI art. 18, section IV, as of 2026-10-26 · in force
Cash payment ban threshold for real estate (8,025 UMA, 2026)	941412.75 MXNLFPIORPI art. 32, section I, as of 2026-10-26 · in force
Cash payment ban threshold for vehicles, jewelry, art and shares (3,210 UMA, 2026)	376565.10 MXNLFPIORPI art. 32, sections II, III and VI, as of 2026-10-26 · in force
Maximum company fine for serious offences where no benefit is proven	1500000 UMALGRA art. 81, section II, item a), as of 2026-10-26 · in force
Maximum public procurement ban for companies	10 yearsLGRA art. 81, section II, item b), as of 2026-10-26 · in force
Limitation period for offences by private parties	7 yearsLGRA art. 74, as of 2026-10-26 · in force
SEMARNAT term to resolve an environmental impact statement	60 daysLGEEPA art. 35 Bis, as of 2026-10-26 · in force
Daily UMA value from 1 February 2026	117.31 MXNINEGI publication DOF 9 January 2026, as of 2026-10-26 · in force

The rule

1. Merger control: mandatory, suspensory filing above three UMA based thresholds. A transaction must be cleared by the Commission before closing when (I) the deal, wherever signed, is worth more than 16 million times the daily UMA in Mexico, directly or indirectly; (II) it gives 30 percent or more of the assets or shares of a business whose Mexican sales or Mexican assets exceed 16 million UMA; or (III) it accumulates in Mexico assets or capital above 7.4 million UMA and two or more parties have Mexican sales or assets, jointly or separately, above 40 million UMA. Clearance is needed before the act is perfected or a condition precedent is met, before control or shares are acquired, before a merger agreement is signed, or before the last step of a series of acts crosses a threshold; foreign deals must be filed before they take effect in Mexico. Unauthorized deals produce no legal effects, cannot be recorded in corporate books, notarized or registered, and notaries who intervene are fined. The Commission has 30 days from receipt (or from the additional information) to decide, extendable by up to 20 days in exceptionally complex cases; silence means no objection. A clearance is valid for six months, extendable once. Under the reform of DOF 16 July 2025 the authority is the National Antimonopoly Commission (Comisión Nacional Antimonopolio, CNA), a decentralized body under the Ministry of Economy, which replaced COFECE and absorbed the antitrust powers of the telecom regulator IFT once its five member board was in place.
Cost to do it: No filing fee appears in the LFCE. The real cost is external antitrust counsel and economic analysis plus deal timing: allow at least 30 days of review after a complete filing, plus up to 10 days for a deficiency notice, 15 days for information requests and up to 20 more days in complex cases.
Example: With the 2026 UMA of MXN 117.31, the thresholds are MXN 1,876,960,000 (16 million UMA) for sections I and II, and MXN 868,094,000 (7.4 million UMA) plus MXN 4,692,400,000 (40 million UMA) for section III. / About USD 101.4 million, USD 46.9 million and USD 253.6 million respectively. A USD 60 million acquisition of a Mexican target by a group whose Mexican sales alone exceed about USD 253.6 million must be filed under section III even though it is below the USD 101.4 million transaction threshold.Ley Federal de Competencia Económica (LFCE), DOF 23 May 2014, arts. 86 and 90 reformed by decree DOF 16 July 2025, last reform DOF 14 November 2025 (Chamber of Deputies consolidated text), Arts. 10, 86, 87, 88 and 90; transitory articles First to Third of the decree of DOF 16 July 2025, 2025-07-16 official text · verified 2026-10-26 · changed: Decree DOF 16 July 2025: COFECE and the antitrust role of IFT replaced by the CNA once its board was in place; the review term in art. 90, section V reformed and now set at 30 days; fines in art. 127 reformed, with gun jumping now from 50,000 UMA up to 8 percent of income.

2. Antitrust penalties. The Commission may order the practice or concentration corrected or suppressed and order full or partial divestiture. Fines run up to 15 percent of the economic agent's income for absolute monopolistic practices (cartels), up to 10 percent for relative monopolistic practices (abuse of dominance) and for unlawful concentrations, and from 50,000 UMA up to 8 percent of income for closing a reportable deal without prior clearance (gun jumping), rising to 200,000 UMA and up to 15 percent of income when the Commission had already objected. Breaching merger conditions costs up to 12 percent of income. Individuals who took part on behalf of a company face disqualification as directors, managers or officers for up to five years and fines up to 350,000 UMA; notaries who formalize an unauthorized deal face up to 200,000 UMA.
Cost to do it: Exposure, not a fee. Gun jumping floor: 50,000 UMA, MXN 5,865,500 (about USD 317,000) in 2026, plus possible unwinding.
Example: A group with Mexican income of MXN 2,000 million that closes a reportable deal without clearance risks a fine of MXN 5,865,500 up to MXN 160 million (8 percent). / About USD 317,000 up to USD 8.6 million on income of about USD 108 million.Ley Federal de Competencia Económica, art. 127 as reformed by decree DOF 16 July 2025, Art. 127, sections I, II, IV, V, VII, VIII, IX, X and XIII, 2025-07-16 official text · verified 2026-10-26 · changed: Decree DOF 16 July 2025 reformed the art. 127 fines, which now reach 15 percent of income for cartels, 50,000 UMA up to 8 percent of income for gun jumping (200,000 UMA up to 15 percent after an objection) and 350,000 UMA for individuals.

3. Personal data: a new law since 21 March 2025. The Federal Law on Protection of Personal Data Held by Private Parties of DOF 20 March 2025 replaced the 2010 law and moved supervision from the abolished INAI to the Ministry of Anticorruption and Good Government. Every controller must give a privacy notice before processing stating its identity and address, the data processed (flagging sensitive data), the purposes (separating those that need consent), options to limit use, how to exercise access, rectification, cancellation and objection (ARCO) rights and how changes are notified; answer ARCO requests within a maximum of 20 days; keep administrative, technical and physical security measures; and inform data subjects immediately of breaches that significantly affect their property or moral rights. Transfers to third parties in Mexico or abroad require sharing the privacy notice and the recipient takes on the controller's duties; consent is not needed for transfers to controlling, subsidiary or affiliated companies under common control operating under the same internal processes and policies, or transfers needed for a contract in the data subject's interest, among other cases. Fines run from 100 to 160,000 UMA or 200 to 320,000 UMA depending on the breach, with an extra fine of up to 320,000 UMA for repeat breaches and up to double for sensitive data; criminal penalties of three months to five years apply to some misuse.
Cost to do it: No registration or filing fee for private controllers in the law. Typical cost is drafting privacy notices, an internal ARCO procedure and security policies with local counsel. Maximum fine 320,000 UMA, MXN 37,539,200 (about USD 2.0 million) in 2026, doubled for sensitive data.
Example: An online retailer that collects health data without the consent required for sensitive data faces fines in the upper band of up to MXN 37,539,200, which may be doubled to MXN 75,078,400. / About USD 2.0 million, or about USD 4.1 million when doubled.Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), new law DOF 20 March 2025, in force the next day, last reform DOF 14 November 2025 (Chamber of Deputies consolidated text), Arts. 2, section XV, 14, 15, 18, 19, 31, 35, 36, 59, 62 and 63; transitory articles First and Second, 2025-03-20 official text · verified 2026-10-26 · changed: New law DOF 20 March 2025 (in force 21 March 2025) abrogated the law of DOF 5 July 2010 and transferred the regulator role from INAI to the Ministry of Anticorruption and Good Government.

4. Anti money laundering for non financial businesses (vulnerable activities). Businesses that habitually or professionally carry out activities listed in the AML law must register in the vulnerable activities registry, identify clients and their beneficial owners with official documents, obtain information on the client's occupation, keep supporting records for at least ten years, and file notices with the Ministry of Finance (SHCP) by the 17th of the month after the operation. Examples of notice thresholds: real estate development, construction or brokerage of property sales and receiving funds for a real estate development, 8,025 UMA; sales of vehicles, 6,420 UMA; non bank loans or guarantees, 1,605 UMA; precious metals, stones, jewelry and watches, 1,605 UMA. The same law bans settling in cash (pesos, foreign currency or precious metals), even through a bank, the purchase of real estate from 8,025 UMA and of vehicles, jewelry, watches, art, shares or partnership interests from 3,210 UMA. Fines run from 200 to 2,000 UMA for failures to identify or late notices, up to 10,000 to 65,000 UMA, or 10 to 100 percent of the operation's value if higher, for omitted notices or prohibited cash payments; a first spontaneous correction before a review starts may be exempt from fines.
Cost to do it: Registration and notices are filed online at no fee; the cost is a KYC process, a compliance officer where the rules require one, and ten years of records. Real estate notice and cash ban threshold: 8,025 UMA, MXN 941,412.75 (about USD 50,900) in 2026.
Example: A developer selling an apartment for MXN 3.5 million must identify the buyer and its beneficial owner, file a notice by the 17th of the next month and cannot accept any cash for the price, since it exceeds MXN 941,412.75. Taking MXN 1 million in cash exposes it to a fine of the greater of MXN 1,173,100 to MXN 7,625,150 or 10 to 100 percent of the operation's value. / About USD 189,000 for the apartment; the cash ban applies from about USD 50,900 for real estate and about USD 20,400 (3,210 UMA, MXN 376,565.10) for vehicles, shares or jewelry.Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (LFPIORPI), DOF 17 October 2012, last reform DOF 16 July 2025 (Chamber of Deputies consolidated text); regulation last reformed DOF 27 March 2026, Arts. 17, sections IV, V, V Bis, VI and VIII; 18; 23; 32; 53; 54 and 55, 2025-07-16 official text · verified 2026-10-26 · changed: Decree DOF 16 July 2025 restated thresholds, added receipt of funds for real estate developments as a vulnerable activity (art. 17, section V Bis), extended record keeping to ten years, set the uniform notice deadline on the 17th of the following month and allowed temporary suspension of operations with certain clients (art. 54 Bis).

5. Anti corruption: company liability for bribery. A private party commits bribery when it promises, offers or delivers any undue benefit to public servants, directly or through third parties, in exchange for acts or omissions related to their functions or the abuse of real or supposed influence, whether or not the benefit is accepted. Companies are sanctioned when individuals acting in their name or on their behalf commit serious administrative offences seeking a benefit for the company. Sanctions for companies, imposed by the administrative courts: up to twice the benefit obtained or, if none, 1,000 to 1,500,000 UMA; a ban on public procurement for three months to ten years; suspension of activities for three months to three years; dissolution; and damages. Suspension and dissolution apply only when the company obtained an economic benefit and its management, supervisory bodies or shareholders took part, or where it is systematically used for serious offences. The authority assesses whether the company has an integrity policy with seven elements: an organization and procedures manual, a published code of conduct, control and audit systems, internal and external whistleblowing channels with discipline, training, hiring policies that screen integrity risks, and transparency of interests. The limitation period for offences by private parties is seven years. Separately, the Federal Criminal Code punishes bribery of domestic officials and of foreign public officials in international business with two to fourteen years in prison where the bribe exceeds 500 UMA, and up to 1,000 days fine, suspension or dissolution for the company.
Cost to do it: Building the art. 25 integrity policy (manual, code of conduct, audit, hotline, training) is an internal and advisory cost; no filing is required. Maximum company fine where no benefit is proven: 1,500,000 UMA, MXN 175,965,000 (about USD 9.5 million) in 2026.
Example: A subsidiary whose customs agent pays an official to speed a clearance can be fined from MXN 117,310 to MXN 175,965,000 if no benefit is proven, or up to twice the benefit, and barred from public tenders for up to ten years. / About USD 6,300 to USD 9.5 million. The criminal 500 UMA line is MXN 58,655, about USD 3,200.Ley General de Responsabilidades Administrativas (LGRA), DOF 18 July 2016, last reform DOF 15 December 2025; Código Penal Federal, art. 222 bis added DOF 17 May 1999 and reformed DOF 23 August 2005, last reform of the code DOF 13 March 2026 (Chamber of Deputies consolidated texts), LGRA arts. 24, 25, 66, 74 and 81, section II; Código Penal Federal arts. 222 and 222 bis, 2016-07-18 official text · verified 2026-10-26

6. Environmental impact authorization before works start. Projects in listed federal activities need a prior environmental impact authorization from the Ministry of Environment (SEMARNAT): water works and general communication routes, oil, gas and other pipelines; oil, petrochemical, chemical, steel, paper, sugar, cement and electricity industries; mining exploration, extraction and processing; hazardous waste facilities; forest use in tropical forests; changes of land use in forest areas, jungles and arid zones; industrial parks with highly risky activities; real estate developments affecting coastal ecosystems; works in wetlands, coastal zones and federal protected areas; and other federal works that may cause serious ecological imbalance. The regulation sets which works are exempt. SEMARNAT must resolve within 60 days of receiving the environmental impact statement (MIA); requests for clarification suspend the term for up to 60 days, and in exceptionally complex projects the term may be extended by up to 60 more days. Breaches are punished with fines of 30 to 50,000 days of the general minimum wage, temporary or permanent closure, administrative arrest of up to 36 hours, seizure and suspension or revocation of permits.
Cost to do it: The statement is prepared by environmental consultants who sign it under oath (art. 35 Bis 1). Plan for 60 days of review after filing, which can reach about 180 days with a 60 day suspension and a 60 day extension, before any site work.
Example: A cement plant expansion filed on 1 February can expect a decision by early April at best, or around late July if SEMARNAT asks for more information and extends the review. / Timing rather than money drives the cost: on a USD 100 million plant, each month of delay postpones revenue and keeps capital idle.Ley General del Equilibrio Ecológico y la Protección al Ambiente (LGEEPA), DOF 28 January 1988, art. 28 reformed DOF 23 February 2005, art. 35 Bis added DOF 13 December 1996, last reform of the law DOF 19 January 2026 (Chamber of Deputies consolidated text), Arts. 28, 35 Bis and 171, 2005-02-23 official text · verified 2026-10-26

Regime	Law	Authority	Trigger	Headline sanction
Merger control and antitrust	LFCE (reform DOF 16 July 2025)	National Antimonopoly Commission (CNA)	Deal above 16 million UMA (MXN 1,877 million, about USD 101 million) or other art. 86 tests	Up to 15 percent of income for cartels; 8 percent for gun jumping
Personal data	LFPDPPP (DOF 20 March 2025)	Ministry of Anticorruption and Good Government	Any private processing of personal data	Up to 320,000 UMA (MXN 37.5 million, about USD 2.0 million), doubled for sensitive data
Anti money laundering	LFPIORPI (reform DOF 16 July 2025)	Ministry of Finance (SHCP)	Listed vulnerable activities above UMA thresholds	Greater of 10,000 to 65,000 UMA or 10 to 100 percent of the operation
Anti corruption	LGRA; Código Penal Federal arts. 222 and 222 bis	Administrative courts; federal prosecutors	Bribery by anyone acting for the company	Up to 1.5 million UMA or twice the benefit, procurement ban, dissolution
Environmental impact	LGEEPA arts. 28 and 35 Bis	SEMARNAT	Listed industries and sensitive sites	Closure, revocation of permits, fines of up to 50,000 days of minimum wage

Mexico's five core regulatory regimes for a foreign owned business (2026 peso amounts at UMA MXN 117.31; USD at MXN 18.5026)

Worked example

A US manufacturer buys a Mexican chemical company for USD 120 million (about MXN 2,220 million). The price exceeds 16 million UMA (MXN 1,876,960,000), so the deal must be filed with the CNA and cannot close before clearance or 30 days of silence after a complete filing (LFCE arts. 86 and 90). If the buyer plans a new reactor line, it needs a SEMARNAT environmental impact authorization first, with a 60 day review term (LGEEPA arts. 28, section II, and 35 Bis).
After closing, the target's privacy notice is updated to name the new group, and intra group transfers of employee data to the US parent need no new consent because they go to an affiliate under common control applying the same policies (LFPDPPP arts. 15 and 36, section III).
If the target also sells company housing to staff for MXN 1.2 million each, those sales exceed 8,025 UMA (MXN 941,412.75), so each one needs buyer identification, a notice by the 17th of the next month and no cash payment (LFPIORPI arts. 17, 23 and 32).

Step by step

1. Before signing any acquisition or joint venture, test the three LFCE art. 86 thresholds using the current UMA and Mexican sales and assets of all parties; build the CNA clearance into the conditions precedent. Timeline: 30 days of review after a complete filing, longer with information requests.
2. Map whether any activity of the Mexican business is a vulnerable activity under LFPIORPI art. 17; if so, register in the vulnerable activities registry, set up client and beneficial owner identification, and calendar monthly notices by the 17th.
3. Remove cash from price payments above the art. 32 thresholds for real estate, vehicles, jewelry, art and share transfers, and instruct notaries accordingly.
4. Issue privacy notices for customers, employees and suppliers that meet LFPDPPP art. 15, set up a 20 day ARCO response process and a breach notification protocol, and document the legal basis for transfers abroad.
5. Adopt an integrity policy with the seven elements of LGRA art. 25 and extend it to agents, customs brokers and other third parties who deal with officials.
6. For any new plant, mine, pipeline, industrial park or coastal project, file the environmental impact statement with SEMARNAT and do not break ground until the authorization is issued. Plan for 60 days and up to about 180 days.
7. Re run UMA based thresholds every February, when the new UMA takes effect.

Common traps

Closing, registering share transfers or even acquiring control before CNA clearance: the act has no legal effect, cannot be notarized or registered, and the fine starts at 50,000 UMA (LFCE arts. 86 and 127, section VIII).
Assuming a foreign to foreign deal is exempt: thresholds count the value and assets in Mexico, directly or indirectly, wherever the deal is signed, and foreign deals must be cleared before they take effect in Mexico (LFCE arts. 86 and 87).
Ignoring a series of small acquisitions: the obligation is triggered when the last act of a series crosses the threshold (LFCE art. 87, section IV).
Sharing commercially sensitive information with the target before clearance: the parties must refrain from exchanges that could be sanctioned (LFCE art. 88).
Accepting cash, including dollars, for a property or share purchase above the thresholds, even if deposited through a bank: the ban applies to cash settled through a financial entity too (LFPIORPI art. 32).
Treating AML duties as a bank only matter: developers, car dealers, jewelers, non bank lenders and others are directly obliged and must keep records for ten years (LFPIORPI arts. 17 and 18).
Keeping a privacy notice drafted under the 2010 law and addressed to INAI: the 2010 law was abrogated and INAI's role passed to the Ministry of Anticorruption and Good Government (LFPDPPP transitory articles).
Relying on a paper code of conduct: LGRA art. 25 requires systems of real application, audit, whistleblowing and training to count as an integrity policy.
Starting site preparation while the environmental statement is under review: works in listed activities need the authorization in advance (LGEEPA art. 28).

Sources

← Sectors in Mexico: foreign ownership caps by activity, electricity under the 2025 Electricity Sector Law, oil and gas through Pemex mixed contracts, mining concessions and duties, and telecom concessionsDisputes in Mexico: courts, commercial arbitration, enforcing awards and judgments, amparo and investment treaty claims →